1. Field of the Invention
The present invention relates to computer software, and deals more particularly with methods, systems, computer program products, and methods of doing business whereby document components are secured or controlled using “security containers” which encapsulate the components (and other component metadata).
2. Description of the Related Art
Traditional techniques for securing content are by providing access control and functional control at the granularity of entire files, whole documents, and sometimes individual e-mail messages. These controls are used to restrict specific operations such as the reading, writing, sending, and duplication of content. As an example of access controls, a server may require authentication of the user who requests a file and then look up the user's credentials in an access control list to determine whether to provide the file and, if so, what operations the user is allowed to perform on it.
In general, any time content is presented to a user in the clear (i.e., unencrypted), there is usually a simple way to bypass the foregoing simple prior-art access controls. After bypassing the access controls, the content can be saved in unencrypted form, modified, or sent to another user in the clear. That is, in the absence of any functional controls, once content is made available to a user, control over whether to perform further operations on the content, and who may receive and view the content, passes to the user who has the content in his possession, rather than remaining vested in the user who created the content.
Once a user receives access to content, various types of functional controls may, in some cases, be provided by various aspects of the system to govern what operations the user can perform on that content. If the content is a text file, for example, the user is typically allowed to edit the text unless the file has been marked (e.g., via an attribute maintained by the file system or operating system software) as read-only or the file has otherwise been secured against editing (such as by requiring a special password before allowing updates). Textual information might be provided in rendered form, alternatively, to prevent the receiving user from editing the text. Such controls are easily bypassed, however, and therefore the protection they provide tends to be very weak. For example, if a file-writing operation is blocked by a file-system read-only attribute, a user who is familiar with the file system can reset the attribute in a matter of seconds. Or, the user can save the file to a different file, for which the read-only attribute has not been set.
As another example of functional controls, the Lotus Notes® e-mail application can be configured not to send an outbound e-mail message having a “confidential” security attribute to any recipients whose address is outside the local intranet. Or, in some cases, an e-mail message may still be delivered to such recipients, but this message will have the text and any attachments suppressed—in effect, providing the recipient with only a notification that the sender attempted to send something more. Here, the application system is responsible for maintaining certain controls (and in this example, maintains them at a per-document, all-or-nothing level). As in the other examples which have been discussed, the user may rather easily avoid these functional controls: he simply has to remove the security attribute from the e-mail message, and the complete message can be sent. (“Lotus Notes” is a registered trademark of International Business Machines Corporation in the United States, other countries, or both.)
An encrypted document may be automatically decrypted by a process executing on the receiving client device, using prior art techniques. For example, some e-mail systems automatically decrypt e-mail messages that are received in encrypted form. Prior art techniques operating on the client device may automatically enforce functional controls on the decrypted result. For example, a multimedia player may allow the user to view a previously-encrypted movie or listen to a previously-encrypted song, but prevent the user from making a copy of the movie or of the song. This is sometimes referred to as “sealed media” or “digital rights” management.
Other types of functional controls include limiting whether various content can be transferred among programs using a “cut and paste” approach. For example, operating systems often support a dynamic data exchange, or “DDE”, protocol that enables a source object to be copied to a buffer that is used to provide a “clipboard” metaphor. The source object might be, for example, a word or phrase from a text document, a graphic image or drawing used in a graphics application, and so forth. (Typically, information identifying the object's type, or an identification of the application with which it was created, is stored in the buffer along with a serialized representation of the object that is copied to the clipboard.) Once a copy of the source object's information is stored in this buffer, the ability to paste that object to a target location is controlled by the clipboard function, which first checks to ensure that the object's type is compatible with the target. So, for example, text from a source document being viewed in one window of a text editor program may be pasted into a target document being viewed in another window of that text editor program. Or, the text might be pasted into an e-mail message being composed with an e-mail application, if the e-mail application is adapted for processing this particular type of object. On the other hand, if the user attempts to paste content of a type not understood by the target application (such as a particular type of image file, or a proprietary file type), then the paste operation will fail, because the target application lacks support for that object type.
While these traditional techniques are adequate in many cases, they provide only an all-or-nothing approach to securing content. That is, a particular file (or document, message, etc.) is either completely protected with access and functional controls, or it is completely unprotected. There are many situations where it would be advantageous for the content creator to have enduring access control and functional control over the content, and/or to provide such control at a more granular level.